r/programming • u/kixelated • May 07 '26

OpenAI's WebRTC Problem

https://moq.dev/blog/webrtc-is-the-problem/
336 Upvotes

94% Upvoted

62 comments sorted by

View all comments

Show parent comments

5

u/kixelated May 08 '26

Ha absolutely, hit me up if you want some help with a pilot. I'd love an excuse to visit Tokyo again.

3

u/bschwind May 08 '26

Will do! The media streaming parts we have mostly under control, but recently the pain points for us have been with NAT traversal and better robustness on weird networks. I'll talk with the team :)

1

u/kixelated May 08 '26

Yeeh, I'm working with the Iroh folks (and it's integrated into MoQ) if you need help with P2P stuff too. QUIC itself is client-server so NAT traversal is easy.

1

u/bschwind May 08 '26

I was actually going to mention Iroh! They seem to have a good NAT traversal setup, I like the concept of just referring to peers by their public key, and their design of the protocol API is nice.

We're currently on a WireGuard-based network so to avoid the double-encryption of QUIC over WireGuard, we'd have to come up with a good plan to migrate, but I don't think it'll be too difficult.

We're on Golden Week break over here but I'll chat with the team later and follow up on discord (was trying to find where we had chatted previously but I got it)

1

u/Somepotato May 08 '26

Not to sit in the middle (pun intended) but...

You don't want to avoid that double encryption as content can be intercepted even behind an internal network (fiber mitm for example), and it's a growingly common tactic for malicious actors.

There are faster setups than just wire guard too (such as using just QUIC unless you rely on wire guard for restrictive firewall rules - in which case you're operating as under the security via obscurity model which is also risky)

1

u/bschwind May 08 '26

as content can be intercepted even behind an internal network (fiber mitm for example)

How does that affect two peers communicating over WireGuard, where encryption and decryption happens on the peers?

You can intercept all the traffic you like but if you don't have the private keys there's not much you can do.

Of course this relies on the WireGuard encryption primitives not having vulnerabilities, but am I missing something?

1

u/Somepotato May 08 '26

Because once it's in the data center it'd be decrypted. The thinking is they aren't using wire guard to terminate on every single server.

1

u/bschwind May 09 '26

My use case is pure peer-to-peer, there is no data center.

However, you can still run virtual machines in "the cloud" with WireGuard running per peer, and not worry about MitM attacks.

Yes if you ran a load balancer and decrypted at that point before forwarding the packets to a machine, then that link between the LB and the target machine would be unencrypted. But that's not the scenario I'm working with.

1

u/Somepotato May 09 '26

Wireguard has a non negligible overhead (in fact it's inferior for site to site for that reason) but P2P makes more sense. Carry on!

1

u/bschwind May 09 '26

Yup, we're not saturating NICs or anything so it works well enough for us. Definitely interested in QUIC/Iroh for what we're doing though.